...
Failure to define wrappers around native methods can allow unprivileged callers to invoke them and exploit inherent vulnerabilities such as buffer overflows in native libraries.
Rule | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
JNI00-J | Medium | Probable | No |
No | P4 | L3 |
Automated Detection
Automated detection is not feasible in the fully general case. However, an approach similar to Design Fragments [Fairbanks 2007] could assist both programmers and static analysis tools.
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Klocwork |
| JAVA.NATIVE.PUBLIC | |||||||
| Parasoft Jtest |
| CERT.JNI00.NATIW |
| Use wrapper methods to secure native methods |
Related Guidelines
CWE-111, Direct Use of Unsafe JNI | |
Guideline 5-3 / INPUT-3: Define wrappers around native methods |
Bibliography
...
...